github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3045] Ping Broken #1910

New issue

Open

opened 2026-05-05 08:34:29 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:34:29 -06:00

Owner

Originally created by @blinux45 on GitHub (Nov 14, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3045

I am reopening ticket #2970, "Ping Broken", because there is a bug:
https://github.com/netblue30/firejail/issues/2970

PRELIMINARY
$ ls -lA /bin/ping
-rwxr-xr-x 1 root root 68076 Nov 10 2016 /bin/ping
Please not that ping is not setuid.

TEST #1
$ firejail --noprofile ping -c1 192.168.1.1
Parent pid 5278, child pid 5279
Child process initialized
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.441 ms
--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.441/0.441/0.441/0.000 ms

Ping works

TEST #2
$ firejail --noprofile --private-bin=bash,ping --caps.keep=net_raw ping -c1 192.168.1.1
Parent pid 5374, child pid 5375
Child process initialized
ping: socket: Operation not permitted
Parent is shutting down, bye...

Ping does not work, despite having the appropriate capabilities.

Originally created by @blinux45 on GitHub (Nov 14, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/3045 I am reopening ticket #2970, "Ping Broken", because there is a bug: https://github.com/netblue30/firejail/issues/2970 PRELIMINARY $ ls -lA /bin/ping -rwxr-xr-x 1 root root 68076 Nov 10 2016 /bin/ping Please not that ping is not setuid. TEST #1 $ firejail --noprofile ping -c1 192.168.1.1 Parent pid 5278, child pid 5279 Child process initialized PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.441 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.441/0.441/0.441/0.000 ms Ping works TEST #2 $ firejail --noprofile --private-bin=bash,ping --caps.keep=net_raw ping -c1 192.168.1.1 Parent pid 5374, child pid 5375 Child process initialized ping: socket: Operation not permitted Parent is shutting down, bye... Ping does not work, despite having the appropriate capabilities.

gitea-mirror added the

duplicate

label 2026-05-05 08:34:29 -06:00

gitea-mirror commented

2026-05-05 08:34:32 -06:00

Author

Owner

@Vincent43 commented on GitHub (Nov 14, 2019):

Ping does not work, despite having the appropriate capabilities.

No, it doesn't have appropriate capabilities. As nosuid description states:

Do not honor set-user-ID and set-group-ID bits or file capabilities when executing programs from this filesystem.

So this is same issue where nosuid is applied unconditionally with private-bin option. As stated in https://github.com/netblue30/firejail/issues/2970#issuecomment-541425259 discussion should continue in https://github.com/netblue30/firejail/issues/2969 .

@Vincent43 commented on GitHub (Nov 14, 2019): > Ping does not work, despite having the appropriate capabilities. No, it doesn't have appropriate capabilities. [As nosuid description states](https://manpages.ubuntu.com/manpages/eoan/en/man8/mount.8.html): > Do not honor set-user-ID and set-group-ID bits or **file capabilities** when executing programs from this filesystem. So this is same issue where `nosuid` is applied unconditionally with `private-bin` option. As stated in https://github.com/netblue30/firejail/issues/2970#issuecomment-541425259 discussion should continue in https://github.com/netblue30/firejail/issues/2969 .

gitea-mirror commented

2026-05-05 08:34:32 -06:00

Author

Owner

@blinux45 commented on GitHub (Nov 18, 2019):

This is not simply a nosuid issue.
To prove it, let's run the following tests:

Test #1: Setup
$ mkdir /var/bin2
$ mount -o ro,bind,nosuid /bin/ /var/bin2/
$ mount -o remount,nosuid /bin /var/bin2/

Let us verify
$ mount | grep bin2
/dev/sda99 on /var/bin2 type ext4 (rw,nosuid,relatime,errors=remount-ro,data=ordered)
We can see that /var/bin2 is nosuid

$ ls -lA /var/bin2/ping
-rwxr-xr-x 1 root root 68076 Nov 10 2016 /var/bin2/ping
ping does not have suid and doesn't require it as was shown in my first post.

Test #2: Running ping on /var/ping2

$ /var/bin2/ping -c1 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.501 ms
--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.501/0.501/0.501/0.000 ms

ping works and /var/bin2 is nosuid !

@blinux45 commented on GitHub (Nov 18, 2019): This is not simply a nosuid issue. To prove it, let's run the following tests: Test #1: Setup $ mkdir /var/bin2 $ mount -o ro,bind,nosuid /bin/ /var/bin2/ $ mount -o remount,nosuid /bin /var/bin2/ Let us verify $ mount | grep bin2 /dev/sda99 on /var/bin2 type ext4 (rw,nosuid,relatime,errors=remount-ro,data=ordered) We can see that /var/bin2 is nosuid $ ls -lA /var/bin2/ping -rwxr-xr-x 1 root root 68076 Nov 10 2016 /var/bin2/ping ping does not have suid and doesn't require it as was shown in my first post. Test #2: Running ping on /var/ping2 $ /var/bin2/ping -c1 192.168.1.1 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.501 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.501/0.501/0.501/0.000 ms ping works and /var/bin2 is nosuid !

gitea-mirror commented

2026-05-05 08:34:33 -06:00

Author

Owner

@Vincent43 commented on GitHub (Nov 19, 2019):

What distro you use?

@Vincent43 commented on GitHub (Nov 19, 2019): What distro you use?

gitea-mirror commented

2026-05-05 08:34:34 -06:00

Author

Owner

@blinux45 commented on GitHub (Nov 22, 2019):

debian 9 stretch

@blinux45 commented on GitHub (Nov 22, 2019): debian 9 stretch

gitea-mirror referenced this issue

2026-05-05 10:14:12 -06:00

[PR #1910] [MERGED] Add XMind profile #4123

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1910

No description provided.

Rows
Columns